Integrating SSL into a program which uses BSD sockets

Question

I have a TCP networking library which implements a bunch of protocol (redis, http etc), and they are implemented using BSD sockets.

A lot of the code uses select() and other functions that are meant for BSD sockets. Am I right in assuming that this won't work on the SSL sockets? Or will they work as is?

I'm just wondering if SSL and BSD sockets are so different that they require a completely different approach to implementation.

Answer 1

Assuming you are referring to OpenSSL, it sits on top of the socket, it does not replace it. So all direct-socket operations, like select(), still work. The difference, however, is that OpenSSL handles reading and writing for you so you would replace recv() with ssl_read() and send() with ssl_write(), but you can (and in some cases need to) still use select() directly. However, you can't just call it whenever you want, you have to wait until OpenSSL tells you to call it. So, for example, if you have a reading loop that calls select() first and then calls recv() only when select() reports readability, you would have to swap that logic around. Call ssl_read() first, and then call select() only if ssl_read() returns either SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE (note that ssl_read() can perform writing operations internally, and ssl_write() can perform reading operations internally).

Answer 2

One thing that comes to mind is that you should not do a select on the fd via which the ssl connection runs. That is because it might for example say you can read from it while the ssl_read will block. That is then caused for example by SSL doing a key renegotiating and not application data to become available. That's one of the pitfals.